Comment by Gigachad
8 days ago
I'm in small tech saas and users having their accounts breached because they share a password with 100 other services is a constant. I have had to set forced 2FA on many products because we take the blame when the user has their account compromised.
Passkeys offer the same and more security but are less of a pain for the user.
If you also support TOTP and physical security keys as an alternative to passkeys, that should be enough to provide a stable long-term alternative for users of FOSS devices. And of course, RP-side you can choose to never require the remote attestation flag to be set.
Convenience is precisely the thing that big tech established tech platforms want to reward their users with to keep them around. The undeniable convenience of passkeys didn't have to come with a standard that is threatening against unattestable devices like my Linux phone. But it does, and that means passkeys are a way that the industry can discourage people away from using non-Google/Apple/Microsoft-approved devices.
Supporting physical security keys and passkeys is basically the same thing. It's the same APIs and standard (Webauthn). Most of the nonsense like attestation is partly left over from physical security keys but unnecessary and finally optional for passkeys. That's the irony of all this: passkeys were the attempt at "weakening" physical security key requirements for general use consumer things. They stay around for enterprises that still desire requiring specific physical keys. The complicated standards for the huge variety in key types and the relying party having any metadata on which key type was used is a relic of decades of backwards compatibility with physical security keys. Passkeys come with a standard that threatens against unattestable devices because it was built on a standard for attestable physical security keys. Not as much the other way around.
(Apple didn't join the FIDO Alliance on Passkeys until they made sure attestation was an optional feature and no longer a requirement, for consumer privacy reasons.)
Passkeys work on every Linux device I've used. Maybe the BSDs are missing support but there aren't any FOSS issues here.
This panic about "but what if attestation" goes for any standard that people on open source platforms use. What if browsers add attestation? You're only one update away from losing your freedom! Browsers are a conspiracy by big tech! Apple already built remote attestation into Safari under the Private Access Token system, after all.
There is no intent to kill FOSS, not even from Microsoft anymore. The reality is much worse: nobody really cares about FOSS, except for the parts that make money. No big tech CEO is wringing their hands thinking of ways to end freedom once and for all. They just don't care if whatever they do doesn't work on Linux.
Companies like Disney are happy to block any Linux computer already with the standards we have. Not because they hate freedom, but because they don't care their DRM doesn't work.
Attested passkeys, on the other hand, are a massive pain. You'd need to get a list of all the keys for all the normal trusted parties (Google/Microsoft, Apple doesn't even support it, Yubikey, and so on) and keep that list up to date. The moment a model of Yubikey gets a firmware bug published, all keys signed by all Yubikeys of that firmware need to be retracted (and all users locked out) or attestation is meaningless. They're way too much work outside of the space they're actually useful: managed hardware for employees, where the user has already given up any control anyway.
TOTP is not an alternative for passkeys. It's trivial to phish and it does get phished all the time. The only comparable authentication mechanism is client certificates/mTLS, which has been tried and dismissed long ago.